Network Credential Correlation for Pass-the-Hash Risk Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems are vulnerable to Pass-the-Hash and Pass-the-Ticket attacks, where attackers can authenticate to network resources using stolen password hashes or Kerberos tickets, exploiting design flaws in authentication protocols, without needing the actual passwords.
Innovation Solution
A computer-implemented method and system that retrieves and correlates account credentials and access rights across machines in a network to identify potential security risks, mapping credentials to machines and analyzing these correlations to detect and report vulnerabilities, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If password hashes and Kerberos tickets are used for authentication to network resources, then authentication efficiency is improved and plaintext passwords are not required, but security vulnerability increases due to Pass-the-Hash and Pass-the-Ticket attacks
Solution Approach 1:
The system performs preliminary identification of credentials on machines before attackers can exploit them. By proactively scanning for password hashes, Kerberos tickets, and other authentication credentials, and correlating them with account access rights, the system detects potential security risks before they can be exploited in Pass-the-Hash or Pass-the-Ticket attacks
Solution Approach 2:
The system establishes continuous monitoring and correlation between credentials present on machines and account access rights. This feedback mechanism alerts security personnel when credentials that could enable unauthorized access are detected, allowing for real-time security adjustments and prevention of credential exploitation
2Measurement precision
If comprehensive credential scanning and correlation is performed across all machines, then security risk identification accuracy is improved, but system complexity and computational resources increase
Solution Approach 1:
The system segments the security analysis task into distinct modules: credential identification module that scans for specific credential types (password hashes, Kerberos tickets), account access rights retrieval module that queries authentication databases, and correlation module that matches credentials with access rights. This segmentation improves precision while managing complexity through modular design
Solution Approach 2:
The correlation system is designed to handle multiple credential types (NTLM hashes, Kerberos tickets, other authentication credentials) and multiple authentication protocols through a unified approach. The system retrieves and correlates credentials across different machine types and storage locations using universal methods, reducing overall system complexity despite comprehensive coverage
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Methods and systems are disclosed for identifying security risks, arising from credentials existing on machines in the networks that enable access to other machines on the networks. Account credentials indications are retrieved from machines in the network, which indicate that credentials for accounts are stored on those machines. Access rights for accounts are collected, describing the access and operation permissions of these accounts on machines in the networks. A correlation is then performed to identify machines that can be accessed by employing credentials of accounts retrieved from other machines in the network.